Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
07/03/2024, 22:45
General
-
Target
b9da64ef2a624f4b5c4edb9a122d64dd.exe
-
Size
1010KB
-
MD5
b9da64ef2a624f4b5c4edb9a122d64dd
-
SHA1
660f80393eca46f8bac4a5152b61c76b4ec14a42
-
SHA256
d9dd1dcce0bdd6b59b3990ad1d9673625f1436b0cc7f91eb56f134c8079d714f
-
SHA512
d64edcf910bdfc6038b6e42050cd69ae8950e427f97a799d42a73a83db806eee1d03849559a86c16cce0329837e7f48560d90eca7f9d5b36928fe41f68f722dc
-
SSDEEP
12288:hUp+AerOWHS0gmcq7J2YuYTfm6hiYc5plDFwrilMiYTfm:ptOuS09OmfduvlB7lbmf
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9da64ef2a624f4b5c4edb9a122d64dd.exe"C:\Users\Admin\AppData\Local\Temp\b9da64ef2a624f4b5c4edb9a122d64dd.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b9da64ef2a624f4b5c4edb9a122d64dd.exeC:\Users\Admin\AppData\Local\Temp\b9da64ef2a624f4b5c4edb9a122d64dd.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1010KB
MD5fb79ec8266821f33dcb1586873f32db8
SHA122b2b6b7879818cbdc29029dfa8d4bffa5e080ec
SHA256bc8cfb5dbe4e7fbe6db05f4bfb796ad4f4fa4aaafc9accd012cf3422e1ded020
SHA512d69b7e43c2404603747f6fa844e4a8225ca6091238202c50ac75433095a63ace8c5aca511ac553921bfc36c024199f5d529ace2ca349e7ce08a2a7079535aacd
-
Filesize
964KB
-
Filesize
204KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
964KB
-
Filesize
320KB
-
Filesize
204KB
-
Filesize
264KB
-
Filesize
320KB
-
Filesize
964KB